openclaw-twoway deployment

数据流向：
1. 钉钉/飞书 → Webhook → 云端网关
2. 云端网关 → WebSocket → 本地节点
3. 本地节点 → 执行任务 → 返回结果 → 云端网关
4. 云端网关 → AI 模型 API → 获取回复 → 返回钉钉/飞书

部署前检查清单

| 检查项 | 本地 | 云端 | 验证命令 | |--------|------|------|----------| | Tailscale 账号 | ✅ 同一账号 | ✅ 同一账号 | tailscale status | | Tailscale 连接 | ✅ 已连接 | ✅ 已连接 | tailscale ip | | Node.js (v18+) | ✅ 已安装 | ✅ 已安装 | node -v | | 防火墙 18789 | ❌ | ⚠️ 需放行 | ufw status | | 云安全组 18789 | ❌ | ⚠️ 需放行 | 云控制台检查 | | Token 配置 | ✅ 一致 | ✅ 一致 | 检查配置文件 |

云端完整部署脚本（Remote 模式 + Token 认证）

#!/bin/bash
plan2-cloud-remote-gateway.sh - 方案二：云端远程网关完整部署
set -e
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║     方案二：云端网关 + Tailscale + 本地节点                       ║"
echo "║                  云端远程网关部署 (Remote 模式)                   ║"
echo "╚════════════════════════════════════════════════════════════════╝"
============== 1. 系统环境检测 ==============
echo -e "\n[1/7] 系统环境检测..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    OS=$ID
    echo "  系统：$OS ($PRETTY_NAME)"
else
    echo "  ✗ 无法识别系统"
    exit 1
fi
if [ "$EUID" -ne 0 ]; then
    echo "  ✗ 请使用 root 权限运行"
    exit 1
fi
echo "  ✓ 权限检查通过 (root)"
============== 2. Tailscale 配置 ==============
echo -e "\n[2/7] 配置 Tailscale..."
if ! command -v tailscale &> /dev/null; then
    echo "  安装 Tailscale..."
    if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then
        curl -fsSL https://tailscale.com/install.sh | sh
    else
        echo "  ✗ 不支持的系统，请手动安装"
        exit 1
    fi
fi
systemctl enable --now tailscaled 2>/dev/null || tailscaled &
sleep 3
if tailscale status 2>&1 | grep -q "connected"; then
    TAILSCALE_IP=$(tailscale ip | head -1)
    echo "  ✓ Tailscale: 已连接 ($TAILSCALE_IP)"
else
    echo "  ⚠ Tailscale 未连接"
    echo "  运行：tailscale up"
    read -p "  完成后按回车..."
    TAILSCALE_IP=$(tailscale ip | head -1)
fi
============== 3. 防火墙配置 ==============
echo -e "\n[3/7] 配置防火墙..."
if command -v ufw &> /dev/null && ufw status | grep -q "Status: active"; then
    ufw allow 18789/tcp comment "OpenClaw Gateway"
    echo "  ✓ UFW: 18789/tcp 已放行"
elif command -v firewall-cmd &> /dev/null && systemctl is-active --quiet firewalld; then
    firewall-cmd --permanent --add-port=18789/tcp
    firewall-cmd --reload
    echo "  ✓ Firewalld: 18789/tcp 已放行"
fi
echo "  ⚠ 云服务器安全组需手动放行 18789 (Tailscale IP: $TAILSCALE_IP)"
============== 4. Node.js 配置 ==============
echo -e "\n[4/7] 配置 Node.js..."
if ! command -v node &> /dev/null; then
    echo "  安装 Node.js 22..."
    if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then
        curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
        apt-get install -y nodejs
    else
        echo "  ✗ 不支持的系统"
        exit 1
    fi
fi
echo "  ✓ Node.js: $(node -v)"
npm config set registry https://registry.npmmirror.com 2>/dev/null || true
============== 5. OpenClaw 安装 ==============
echo -e "\n[5/7] 安装 OpenClaw..."
npm install -g openclaw
echo "  ✓ OpenClaw: 已安装"
============== 6. 生成 Token ==============
echo -e "\n[6/7] 生成认证 Token..."
TOKEN=$(openssl rand -hex 20)
echo "  ✓ Token: $TOKEN"
echo "  ⚠ 请保存此 Token，本地节点配置需要"
============== 7. 配置网关 + systemd ==============
echo -e "\n[7/7] 配置网关 (Remote 模式)..."
mkdir -p ~/.openclaw
cat > ~/.openclaw/openclaw.json << EOF
{
  "gateway": {
    "port": 18789,
    "mode": "remote",
    "bind": "lan",
    "auth": {
      "mode": "token",
      "token": "$TOKEN"
    }
  },
  "security": {
    "dangerouslyAllowInsecurePrivateWs": true
  }
}
EOF
echo "  ✓ 配置文件：~/.openclaw/openclaw.json"
echo -e "\n  创建 systemd 服务..."
cat > /etc/systemd/system/openclaw-gateway.service << 'EOF'
[Unit]
Description=OpenClaw Gateway (Remote Mode)
After=network.target tailscaled.service
Wants=tailscaled.service
[Service]
Type=simple
User=root
WorkingDirectory=/root/.openclaw
ExecStart=/usr/bin/node /usr/lib/node_modules/openclaw/dist/index.js gateway --port 18789 --bind lan --allow-unconfigured
Restart=on-failure
RestartSec=10
StartLimitBurst=3
StartLimitIntervalSec=300
Environment=NODE_ENV=production
Environment=OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1
LimitNOFILE=65535
Nice=-5
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable openclaw-gateway
systemctl start openclaw-gateway
sleep 5
============== 验证 ==============
echo -e "\n╔════════════════════════════════════════════════════════════════╗"
if systemctl is-active --quiet openclaw-gateway; then
    echo "║                     ✓ 部署成功                                 ║"
    echo "╚════════════════════════════════════════════════════════════════╝"
    echo -e "\n【服务信息】"
    echo "  服务状态：$(systemctl is-active openclaw-gateway)"
    echo "  运行模式：remote"
    echo "  认证方式：token"
    echo -e "\n【网络信息】"
    echo "  Tailscale IP: $TAILSCALE_IP"
    echo "  网关地址：ws://${TAILSCALE_IP}:18789"
    echo "  Token: $TOKEN"
    echo -e "\n【端口监听】"
    ss -tlnp | grep 18789 || true
    echo -e "\n【本地节点配置示例 (PowerShell)】"
    cat << POWERSHELL
$config = @{
  gateway = @{
    mode = "remote"
    auth = @{ token = "$TOKEN" }
    remote = @{ url = "ws://${TAILSCALE_IP}:18789" }
  }
} | ConvertTo-Json | Out-File ~/.openclaw/openclaw.json -Encoding utf8
POWERSHELL
    echo -e "\n【下一步操作】"
    echo "  1. 在本地运行 plan2-local-node.ps1"
    echo "  2. 检查连接：openclaw status"
    echo "  3. 查看日志：journalctl -u openclaw-gateway -f"
else
    echo "║                     ✗ 部署失败                                 ║"
    echo "╚════════════════════════════════════════════════════════════════╝"
    journalctl -u openclaw-gateway --no-pager -n 20
    exit 1
fi

本地节点完整部署脚本

# plan2-local-node.ps1 - 方案二：本地节点完整部署
param(
    [string]$CloudIP = "",
    [string]$Token = ""
)
$ErrorActionPreference = "Stop"
$OpenClawDir = "$env:USERPROFILE\.openclaw"
$NodeExe = "C:\Program Files\nodejs\node.exe"
$OpenClawMjs = "$env:APPDATA\npm\node_modules\openclaw\openclaw.mjs"
$TaskName = "OpenClaw-Node"
Write-Host "╔════════════════════════════════════════════════════════════════╗" -ForegroundColor Cyan
Write-Host "║     方案二：云端网关 + Tailscale + 本地节点                       ║" -ForegroundColor Cyan
Write-Host "║                    本地节点完整部署                              ║"
Write-Host "╚════════════════════════════════════════════════════════════════╝" -ForegroundColor Cyan
1. 检查 Tailscale
Write-Host "n[1/6] 检查 Tailscale..." -ForegroundColor Yellow
$tsStatus = tailscale status 2>&1
if ($LASTEXITCODE -ne 0) {
    Write-Host "  Tailscale 未运行，正在启动..." -ForegroundColor Yellow
    tailscale up
    Start-Sleep -Seconds 5
}
$tsIP = (tailscale ip | Select-Object -First 1).Trim()
Write-Host "  ✓ Tailscale IP: $tsIP" -ForegroundColor Green
2. 检查 Node.js
Write-Host "n[2/6] 检查 Node.js..." -ForegroundColor Yellow
if (!(Test-Path $NodeExe)) {
    Write-Host "  ✗ Node.js 未安装" -ForegroundColor Red
    Write-Host "  下载：https://nodejs.org/" -ForegroundColor Yellow
    exit 1
}
$nodeVer = & $NodeExe -v
Write-Host "  ✓ Node.js: $nodeVer" -ForegroundColor Green
3. 检查/安装 OpenClaw
Write-Host "n[3/6] 检查 OpenClaw..." -ForegroundColor Yellow
if (!(Test-Path $OpenClawMjs)) {
    Write-Host "  安装 OpenClaw..." -ForegroundColor Yellow
    npm install -g openclaw --registry=https://registry.npmmirror.com
    if ($LASTEXITCODE -ne 0) {
        Write-Host "  ✗ 安装失败" -ForegroundColor Red
        exit 1
    }
}
Write-Host "  ✓ OpenClaw: 已安装" -ForegroundColor Green
4. 获取云端信息
Write-Host "n[4/6] 配置连接信息..." -ForegroundColor Yellow
if ($CloudIP -eq "") {
    Write-Host "  请输入云端网关 Tailscale IP:" -ForegroundColor Yellow
    $CloudIP = Read-Host "  Cloud IP"
}
if ($Token -eq "") {
    Write-Host "  请输入云端网关 Token:" -ForegroundColor Yellow
    $Token = Read-Host "  Token"
}
Write-Host "  云端网关：$CloudIP:18789" -ForegroundColor Green
5. 测试连接
Write-Host "n[5/6] 测试云端连接..." -ForegroundColor Yellow
$testResult = Test-NetConnection -ComputerName $CloudIP -Port 18789 -WarningAction SilentlyContinue -InformationLevel Quiet
if (!$testResult) {
    Write-Host "  ✗ 无法连接云端网关" -ForegroundColor Red
    Write-Host "  请检查：" -ForegroundColor Yellow
    Write-Host "    1. 云端 Tailscale 是否运行" -ForegroundColor Yellow
    Write-Host "    2. 云端网关是否启动" -ForegroundColor Yellow
    Write-Host "    3. 云安全组是否放行 18789" -ForegroundColor Yellow
    exit 1
}
Write-Host "  ✓ 云端网关：可达" -ForegroundColor Green
6. 配置并启动
Write-Host "n[6/6] 配置并启动节点..." -ForegroundColor Yellow
New-Item -ItemType Directory -Force -Path $OpenClawDir | Out-Null
$config = @{
    gateway = @{
        mode = "remote"
        auth = @{ token = $Token }
        remote = @{ url = "ws://$($CloudIP):18789" }
    }
} | ConvertTo-Json -Depth 10
$config | Out-File -FilePath "$OpenClawDir\openclaw.json" -Encoding utf8 -Force
Write-Host "  ✓ 配置：$OpenClawDir\openclaw.json" -ForegroundColor Green
创建启动脚本
$startScript = "$OpenClawDir\start-node.ps1"
@"
$env:OPENCLAW_ALLOW_INSECURE_PRIVATE_WS = "1"
& "$NodeExe" "$OpenClawMjs" node run --host "$CloudIP" --port 18789
"@ | Out-File -FilePath $startScript -Encoding utf8 -Force
启动节点
Write-Host "  启动节点..." -ForegroundColor Yellow
$env:OPENCLAW_ALLOW_INSECURE_PRIVATE_WS = "1"
Start-Process $NodeExe -ArgumentList "$OpenClawMjs", "node", "run", "--host", $CloudIP, "--port", "18789" -WindowStyle Normal
Start-Sleep -Seconds 5
Write-Host "n╔════════════════════════════════════════════════════════════════╗" -ForegroundColor Cyan
Write-Host "║                     ✓ 部署成功                                 ║" -ForegroundColor Green
Write-Host "╚════════════════════════════════════════════════════════════════╝" -ForegroundColor Cyan
Write-Host "n【连接信息】"
Write-Host "  云端网关：ws://$($CloudIP):18789"
Write-Host "  节点状态：启动中..."
Write-Host "n【下一步操作】"
Write-Host "  1. 检查状态：openclaw status"
Write-Host "  2. 查看日志：openclaw logs --follow"
Write-Host "  3. 配置开机自启（可选）："
Write-Host "     schtasks /Create /TN "$TaskName" /TR "powershell -File '$startScript'" /SC ONLOGON /F"

方案三：云端网关 + 本地网关双部署（含同步备份）

完整架构流程图

                              ┌──────────────┐
                              │  通讯软件     │
                              │ (钉钉/飞书)   │
                              └──────┬───────┘
                                     │
                ┌────────────────────┴────────────────────┐
                │                                         │
                ▼                                         ▼
┌───────────────────────────┐               ┌───────────────────────────┐
│    云端网关 (Primary)     │               │   本地网关 (Secondary)     │
│  :18789    │               │   127.0.0.1:18789         │
│                           │               │                           │
│  ┌─────────────────────┐  │               │  ┌─────────────────────┐  │
│  │ 通道插件 (钉钉/飞书) │  │               │  │ 本地通道 (测试/备用) │  │
│  └──────────┬──────────┘  │               │  └──────────┬──────────┘  │
│             │             │               │             │             │
│  ┌──────────▼──────────┐  │               │  ┌──────────▼──────────┐  │
│  │ AI 模型 (云端 API)    │  │               │  │ AI 模型 (本地 API)    │  │
│  │ Claude / Qwen       │  │               │  │ Ollama / LM Studio  │  │
│  └──────────┬──────────┘  │               │  └──────────┬──────────┘  │
│             │             │               │             │             │
│  ┌──────────▼──────────┐  │   同步通道    │  ┌──────────▼──────────┐  │
│  │ 数据同步模块        │◄─┼───────────────┼─►│ 数据同步模块        │  │
│  │ - 会话状态 (实时)   │  │   Tailscale   │  │ - 会话状态 (实时)   │  │
│  │ - 消息历史 (增量)   │  │   (加密)      │  │ - 消息历史 (增量)   │  │
│  └──────────┬──────────┘  │               │  └──────────┬──────────┘  │
│             │             │               │             │             │
│  ┌──────────▼──────────┐  │               │  ┌──────────▼──────────┐  │
│  │ SQLite (云端存储)   │  │               │  │ SQLite (本地存储)   │  │
│  └─────────────────────┘  │               │  └─────────────────────┘  │
└───────────────────────────┘               └───────────────────────────┘
故障转移:
  ┌─────────────────────────────────────────────────────────────────────┐
  │ 正常：通讯软件 → 云端网关 → 处理并回复                               │
  │ 云端故障：本地网关接管 → 离线队列 → 云端恢复后同步                   │
  │ 本地故障：云端继续运行 → 数据从云端恢复                              │
  └─────────────────────────────────────────────────────────────────────┘

部署前检查清单
| 检查项 | 本地 | 云端 | 验证命令 |
|--------|------|------|----------|
| Tailscale 账号 | ✅ 同一账号 | ✅ 同一账号 | tailscale status |
| Tailscale 连接 | ✅ 已连接 | ✅ 已连接 | tailscale ip |
| Node.js (v18+) | ✅ 已安装 | ✅ 已安装 | node -v |
| 防火墙 18789 | ⚠️ 仅本地 | ⚠️ 需放行 | ufw status |
| 云安全组 18789 | ❌ | ⚠️ 需放行 | 云控制台检查 |
| 同步 Token | ✅ 一致 | ✅ 一致 | 检查配置文件 |
本地网关完整部署（含开机自启 + 同步配置）

2. 检查 Node.js

4. 配置网关

$startScript = "$OpenClawDir\start-gateway.ps1" @" $env:OPENCLAW_ALLOW_INSECURE_PRIVATE_WS = "1" & "$NodeExe" "$OpenClawMjs" gateway run "@ | Out-File -FilePath $startScript -Encoding utf8 -Force

创建计划任务

$env:OPENCLAW_ALLOW_INSECURE_PRIVATE_WS = "1" Start-Process $NodeExe -ArgumentList "$OpenClawMjs", "gateway", "run" -WindowStyle Normal

Start-Sleep -Seconds 5

7. 验证

Write-Host "n╔════════════════════════════════════════════════════════════════╗" -ForegroundColor Cyan Write-Host "║ ✓ 部署成功 ║" -ForegroundColor Green Write-Host "╚════════════════════════════════════════════════════════════════╝" -ForegroundColor Cyan

Write-Host "n【访问信息】" Write-Host " 网关地址：ws://localhost:18789" Write-Host " 控制面板：http://localhost:18789/" Write-Host " 开机自启：$TaskName"

Write-Host "n【同步配置】" Write-Host " 云端网关：$CloudIP" Write-Host " 同步端口：${SyncPort}" Write-Host " 同步方向：双向" Write-Host " 同步间隔：300 秒"

Write-Host "n【下一步操作】" Write-Host " 1. 在云端运行 plan3-cloud-gateway.sh" Write-Host " 2. 检查状态：openclaw status" Write-Host " 3. 配置同步：openclaw sync config" } else { Write-Host " ✗ 网关启动失败" -ForegroundColor Red exit 1 }

云端网关完整部署（含同步备份）

故障排查
通用诊断脚本

echo -e "\n【8. 最近日志】" journalctl -u openclaw-gateway --no-pager -n 10 2>&1 || echo "无日志" `

常见问题速查

| 问题 | 可能原因 | 解决方案 | |------|----------|----------| | 端口不通 | 防火墙阻挡 | ufw allow 18789/tcp | | Tailscale 断开 | 认证过期 | tailscale up --force | | 同步失败 | Token 不一致 | 检查两边配置文件 | | 服务无法启动 | 端口占用 | ss -tlnp \| grep 18789` | | Webhook 不响应 | 安全组未放行 | 云控制台添加入站规则 |